Processes personal data, in Nevada

NRS 603A.220 · Read the law's page

• Disclose a security breach of personal information to an affected Nevada resident in the most expedient time possible and without unreasonable delay. Nevada sets no fixed numeric deadline.
• Notify each nationwide consumer reporting agency without unreasonable delay if you determine that notification of the breach is required to more than 1,000 persons at any one time.
• Do not rely on this statute alone to cover a breach of biometric data with no accompanying identifier. Biometric data alone is not within this statute's definition of personal information.
• Expect an elderly or disabled Nevada resident harmed by a breach-notification violation to have an indirect civil action for damages through NRS 603A.260's deceptive-trade-practice deeming and NRS 598.0977, even though a general Nevada resident does not.

NRS 603A.215 · Read the law's page

• If you accept a payment card in connection with a sale of goods or services to a Nevada resident, comply with the current version of the Payment Card Industry (PCI) Data Security Standard adopted by the PCI Security Standards Council, with respect to those transactions, by the compliance date the standard itself sets.
• If you do not accept payment cards, do not transfer a Nevada resident's personal information through an electronic, nonvoice transmission other than a facsimile outside your secure system, and do not move a data storage device containing that personal information beyond your logical or physical controls, unless the data is encrypted using an encryption technology adopted by an established standards-setting body, with appropriate management and safeguards of the cryptographic keys.
• Compliance with this section, combined with a breach not caused by your own gross negligence or intentional misconduct, is a defense to damages for a breach of the security of the system data; a telecommunication provider acting solely to convey the communications of other persons is outside this section entirely.
• Expect an elderly or disabled Nevada resident harmed by a violation of this section to have an indirect civil action for damages through NRS 603A.260's deceptive-trade-practice deeming and NRS 598.0977, even though a general Nevada resident does not.

NRS 603A.415, 603A.430 · Read the law's page

• Treat a voiceprint, faceprint, or other biometric identifier as regulated consumer health data in Nevada only where it is related to a health condition, diagnosis, treatment, or similar information under this chapter.
• Do not rely on any Nevada statute to cover a general-purpose voiceprint or faceprint you collect for identification, authentication, or marketing with no connection to health status. Nevada has no biometric-privacy statute reaching that use.
• Do not assume a photograph or video is exempt. Nevada's biometric data definition names facial imagery directly, with no carve-out for data derived from a recording.

NRS 603A.500-515 · Read the law's page

• Give a Nevada consumer the right to access their consumer health data, obtain a list of third parties it was disclosed to, stop its collection, sharing, or sale, and delete it.
• Respond to a consumer health data rights request within 45 days, with one 45-day extension available, and provide at least two free responses per consumer per year.
• Do not treat this right as reaching personal data outside the consumer health data sector. It does not create a general access, deletion, or portability right.

NRS 603A.535 · Read the law's page

• This binds a person, which in the Nevada Revised Statutes means a natural person, any form of business or social organization or any other nongovernmental legal entity, unless a particular statute provides otherwise (NRS 0.039 and 603A.540(1)).
• Do not sell or offer to sell consumer health data without the written authorization of the consumer to whom the data pertains, or in a manner that is outside the scope of or inconsistent with that authorization (NRS 603A.535(1)).
• Do not condition the provision of goods or services on a consumer authorizing the sale of consumer health data (NRS 603A.535(2)).
• If you sell consumer health data, establish a means by which a consumer may revoke the written authorization, and provide a copy of the authorization to the consumer who signed it and to the purchaser (NRS 603A.535(4) and (7)).
• As a seller or purchaser of consumer health data, retain a copy of the written authorization for at least 6 years after the date on which it expired (NRS 603A.535(8)).

NRS 603A.210 · Read the law's page

• This binds any data collector, a term defined to include a governmental agency, institution of higher education, corporation, financial institution, retail operator, or other business entity or association, that maintains records containing the personal information of a Nevada resident.
• Implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.
• If you are a governmental agency, additionally comply, to the extent practicable, with the current version of the CIS Controls published by the Center for Internet Security or the corresponding National Institute of Standards and Technology standards, with respect to the collection, dissemination, and maintenance of those records.
• Require, by contract, any person to whom you disclose a Nevada resident's personal information to implement and maintain the same reasonable security measures.
• Compliance with a state or federal law that requires greater protection for the same records is deemed compliance with this section.
• Expect an elderly or disabled Nevada resident harmed by a violation of this section to have an indirect civil action for damages through NRS 603A.260's deceptive-trade-practice deeming and NRS 598.0977, even though a general Nevada resident does not.

NRS 603A.300-360 · Read the law's page

• Post a privacy notice if you operate a commercial internet website or online service directed at Nevada residents.
• Honor a Nevada consumer's verified request not to sell their covered information, as an operator or a data broker (name, address, email, phone, Social Security number, or similar contact identifiers maintained in personally identifiable form).
• Do not treat this statute as reaching biometric or other sensitive-category data. Its covered information definition does not name any biometric identifier.
• Cure a first-time compliance failure within 30 days of notice to avoid a violation.